Proofpoint

Cloud Security Acceptance Takes Step Forward as USDA Awards FISMA Certification for Microsoft and Proofpoint, Google FISMA Certification Still Pending

Stephanie Jordan — Thu, 05 May 2011 17:26:21 +0000

Recently the United States Department of Agriculture (USDA) granted Microsoft’s Business Productivity Online Suite—Federal (BPOS-F) the authorization to operate (ATO) under the Federal Information Security Management Act of 2002, more widely known as FISMA. This congressional legislation requires every agency within the United States Federal government to ensure the security and protection of Federal information and information systems. As part of the compliance to the law, each Federal agency must adhere to standards and guidelines that meet minimum security requirements and controls. Each agency has the freedom to select its software and hardware solutions, but there is a certification and accreditation process that must be obtained.

In mid-April there was a scuffle between not yet FISMA-accredited Microsoft and rival Google, as Microsoft called foul for Google Apps for Government being marketed as FISMA certified. It’s actually Google Apps Premier that is FISMA certified. The full expectation is that Google Apps for Government will gain certification, as it’s a modified version of Premier. However, Google assumed its own certification status, which is unfair misrepresentation of its Apps for Government.

About a week later, Microsoft’s BPOS-Federal received FISMA certification and accreditation—the USDA issued an ATO on April 19. BPOS-Federal, which includes Exchange Online, SharePoint Online, and Office Communications Online, is one of several messaging and collaboration solutions hosted by Microsoft Online Services.

“As cloud computing continues to gain traction across government, it’s the responsibility of cloud providers to deliver the same levels of security that agencies have come to expect from on-premise solutions,” notes Susie Adams, chief technology officer for Microsoft Federal. Adams believes the USDA validated its cloud security offer when it granted the ATO to Microsoft. Indeed the cloud does seem to be gaining converts in the original debate questioning if on-premises was more secure.

In her blog, Adams acknowledges the shift, stating: “Meeting the demands of a new computing environment poses security concerns, but the solutions are grounded in the same best practices we’ve been employing on behalf of government agencies for over 25 years.”

It is a complex process to achieve FISMA certification and involves third-party assessments of a wide variety of security features and policies. Yong-Gon Chon, CTO of SecureInfo Corporation, the third-party involved for Microsoft, gave an interesting account of what goes into a FISMA certification. He notes, “Our assessment was rigorous and required Microsoft to demonstrate effective implementation of approximately 160 different management, operational and technical controls to a team of subject matter experts with a combined total of 99 years of industry experience. Our testing included an extensive review of their policies and procedures, interviews with their key personnel involved in delivering and supporting BPOS-F, examination of security related configuration settings, vulnerability scans of all components included within the environment (operating systems, databases, and web applications) and penetration testing.”

In conjunction with Microsoft’s BPOS-Federal FISMA certification, Proofpoint’s Enterprise Archive solution was also granted an ATO by the USDA, which will use the solution for compliant email archiving. According to Proofpoint, Enterprise Archive is the first cloud-based archiving solution to be given the ATO by a Cabinet-level agency and—with its 120,000 Microsoft users spread throughout 21 departments—is the largest U.S. Federal government implementation of cloud-based enterprise email archiving technology to date.

“Many Federal agencies are looking to cloud-based services to help them meet the dual challenges of tightening budgets and more severe and frequent security breaches,” says Andres Kohn, vice president or archiving and eDiscovery solutions for Proofpoint. “By achieving FISMA certification for our email archiving solution in conjunction with Microsoft BPOS-Federal, Proofpoint is opening the door for more rapid adoption of cloud-based email solutions throughout the U.S. Federal community.”

Microsoft plans to pursue FISMA certification and accreditation for Office 365, its next generation cloud productivity suite, after it launches. Google is expecting FISMA certification and accreditation for Google Apps for Government “imminently.”

Can Data Be More Secure in the Cloud?

Stephanie Jordan — Fri, 04 Feb 2011 23:31:09 +0000

There’s no reason data stored in the cloud can’t be more secure and reliable than data stored on-premises. To make this happen, consider four key factors: operational expertise, controlled environments, encryption architectures and redundant infrastructure.

All key factors can be done on-premises, but that can be expensive and difficult, especially for processes that are not core to a business. By core, I’m referring to something that differentiates a company in the eyes of customers, such as the type of products a company provides. Everything else is context, which is important, but doesn’t impact business in the same way.

By moving context functions to the cloud, organizations can reduce costs and redirect those savings to core functions.

Operational Expertise

Security features must be planned for and built into every part of the solution, even for components that aren’t core to a customer’s needs. For example, by owning most components of the SaaS technology stack, an organization can leverage secure software development lifecycles to ensure that security best practices are accounted for in core software, tools, processes and monitoring systems.

A cloud solution also needs dedicated staff for monitoring, security, architecture, platform development, compliance and engineering. Having a dedicated and specialized staff both ensure expertise, and also increase security, because vulnerabilities often happen when technology is implemented without the right level of proficiency.

A cloud solution should also ensure, through continuous validation and auditing, that the right things are being done through a variety of mechanisms, whether those are SAS 70 Type II audits, internal audits, or security probes.

Additionally, cloud services need to operate at scale for specific applications not found in a typical enterprise, which in turn creates a need for automation, ensuring that all the right tasks are happening at the right times.

Controlled Environments

A SaaS solution needs a scalable environment made for performing one task (or set of tasks) in an automated, repeatable, and dependable way. Therefore, cloud providers need a homogenous environment from an OS monitoring tool and even hardware point-of-view in order to increase visibility and decrease risk exposure.

In this environment, there’s not one key person who has access to everything. Instead, there are strict controls regarding when and who can do what, which should be automated to provide an additional level of security.

Data Encryption Architecture

Enterprise-class cloud vendors must ensure that data is encrypted both in transit and at rest, no matter where it resides. Crucial to this are encryption keys, which should be separated from the data or application. One way is to have data in the cloud and keys onsite. Alternatively there could be one cloud where keys are maintained and stored and a separate cloud for data encryption and decryption. Those clouds should communicate through controlled protocols so unauthorized users can’t access both.

Redundant Infrastructure

To deliver services reliably, across multiple datacenters and at scale, cloud solutions need redundant infrastructure. To ensure reliability and disaster recovery, it should be at the core of all architecture.

Redundancy is often overlooked because it is complex, not always cost-effective, and many times it’s an afterthought. But it provides additional security. If attackers target one datacenter, other datacenters are still running.

If an organization looks for SaaS solutions that hit on all of these four factors, they can rest assured that their data will be secure and reliable, even in the cloud.

—

About Andrés Kohn

Andrés Kohn is currently responsible for Proofpoint’s email archiving business unit and has been responsible for setting Proofpoint’s product direction since the inception of the company. In addition, Andrés is responsible for developing strategic technology partnerships that complement Proofpoint’s solution offerings. He joined Proofpoint from Critical Path, where he was director of product management and responsible for the global direction of their messaging products and services. Before joining Critical Path, Andrés held several product marketing positions at PeopleSoft, and various management roles at International Paper as well as Procter and Gamble. Andrés holds a B.S. degree with distinction and an M.S. degree in engineering from Cornell University. He also holds an M.B.A. degree from Stanford University.

The Dangers of Outbound Content

Michael Osterman — Wed, 08 Sep 2010 23:14:15 +0000

We recently completed a major survey for Proofpoint focused on the current state of data loss arising from inappropriate or accidental use of email, social media tools and the like. Here’s a summary of what we found:

Nearly three out of five organizations reported that IT budget cutbacks or other constraints have made it more difficult for them to protect sensitive information from being leaked through email and other venues. When we did the survey last year, that figure was 50%.
One in five organizations has fired an employee for their violation of email policies during the past year, while one-half of organizations have disciplined at least one employee for violating these policies.
During the past year, one in five organizations has investigated the leakage of sensitive or confidential information via a social media site like Twitter or Facebook and the same proportion have disciplined one or more employees for violating corporate social media policies.
Slightly more than one-half of organizations are very concerned about losing sensitive or confidential information via Twitter or similar tools—this figure has increased from 41% when we did the survey last year.

Although we conducted the survey with enterprises (1,000 or more employees), the lessons here are applicable to virtually any size of organization. As I see it, there are three key takeaways from this research:

Establish detailed and thorough use policies for every medium, tool, venue, etc. from which sensitive or confidential might be leaked. This includes email, of course, but also Twitter, Facebook, LinkedIn, Webmail, blogs, wikis, etc. Organizations that don’t have these types of policies run the risk of increased data loss and a less defensible position when disciplining employees for doing something they shouldn’t.
Monitor and manage communication tools. This means implementing the tools and technologies that will allow compliance officers, IT staff or others to see what’s leaving the organization; the ability to turn off some capabilities that may not have business value for some employees (e.g., file-sharing via instant messaging clients); and the ability to check for sensitive or confidential information before it passes the firewall.
Deploy robust encryption capabilities that will permit sensitive data to be sent securely. Most email and other content is not encrypted, even when it contains confidential information or other content that should be encrypted.

You can access a copy of the research here.

Archiving E-Discovery Supplement to Microsoft Exchange Server 2010 Offers Legal Hold

Stephanie Jordan — Fri, 13 Aug 2010 09:34:10 +0000

As already widely reported, Microsoft Exchange Server 2010 offers archive features. Archiving solution vendors have been working on ways to support Exchange 2010 and yet also differentiate from what Microsoft now includes. Proofpoint is one such vendor, and this week it announced a major upgrade to its SaaS (Software-as-a-Service) email archiving solution, Proofpoint Enterprise Archive, an enterprise-grade solution that helps organizations reduce legal discovery risk and costs. According to the company, Proofpoint Enterprise Archive provides a secure, searchable repository of all email messages and enables organizations to easily and consistently perform early case assessments, instantly preserve data in active legal holds and enforce retention policies.

“There has been a lot of interest in companies around e-Discovery in general and legal hold capabilities as it relates to Exchange 2010,” says Andres Kohn, general manager, archiving for Proofpoint. “What we are hearing from customers is that while Exchange 2010 has gone a long way in reducing the burden of large mail boxes, and in many ways reducing the need for archiving to do mailbox management, it has not provided an easy way to put data on legal hold. That is where solutions like ours are migrating towards compliance and e-Discovery. We have done a lot of work around that capability.”

In addition to full support for Microsoft Exchange Server 2010, including support for Microsoft Outlook Web Access, access to stubbed attachments and advanced search capabilities, and support for mixed environments that use multiple Microsoft Exchange server versions including 2003, 2007 and 2010, Proofpoint Enterprise Archive now offers near real-time e-Discovery search. The product can take not only historical data, but can also automatically put new data, as it is being sent and received, on hold so you can keep an ongoing sampling of current data for a litigation matter.

Another new feature is support for EDRM (Electronic Discovery Reference Model) XML, which helps improve interoperability and the transfer of electronically stored information between applications involved in different phases of the discovery process. “There are many solutions across different steps,” explains Kohn. “We are the source for all email that the company has sent and received. If there is a pending litigation and they need to produce data to opposing council, the company has to cull through and find the relevant data and send it to an e-Discovery tool, and then go through the full review, before presenting to opposing council. So we can facilitate that transfer of data.”

When does a company need to consider a solution like Proofpoint Enterprise Archive? If a company expects just one lawsuit a year, Kohn believes it may not be worth it. “However, if a company thinks it may get two or more lawsuits a year, the costs of dealing with those are so high, having an archiving solution in place is really beneficial,” he says.

Kohn also notes that there are very few companies that don’t feel like archiving is something they should do, but companies have not justified the work. But that seems to be changing, “We are seeing IT budgets starting to open up and greater pressure around e-Discovery and legal holds. One reason for the reluctance is the perceived high cost to archiving, and that is where SaaS archiving comes in. There are no up front costs, but security is a concern. A Proofpoint benefit is that we have a hybrid model, with an appliance that sits on the customers premises that holds an encryption key, so that the data going out to the cloud is encrypted.” Kohn points out that Proofpoint does not have the key. “All that data is impossible for us to read. The user can search through that encrypted data from their Web browser and be able to get results back as if it wasn’t encrypted. That has been a real differentiator for us.”

While Exchange 2010 is a main focus of this announcement, moving forward Kohn says that Exchange is just one source of data. “We estimate that 80 percent of all discoveries are towards email, but lately we are seeing a lot more e-Discovery from other data sources—whether it be Sharepoint or file servers or instant messaging communications. Our archive and legal hold capabilities will move from just being on email to other data sources.”

The new version is available now with beginning pricing at $30 (USD) per user per year, including support and storage.

Eye on Messaging is written by Stephanie Jordan, editor in chief of Messaging News. If you have story ideas or news to share, email her: sjordan [at] messagingnews [dot] com

EasyJet and Proofpoint, Inc--Real World Solutions

Stephanie Jordan — Thu, 25 Mar 2010 07:37:24 +0000

EasyJet—Europe’s leading low-fares airline, which operates 182 aircraft and employs about 7,000 supported by an IT staff of 59—sought to greatly reduce the costs, administration and maintenance burdens associated with managing email security. Simplicity, ease-of-use and control for end-users were also critical selection criteria. The company chose a cloud-based email security solution from Proofpoint, Inc.

According to the companies, easyJet signed a multi-year subscription to Proofpoint’s SaaS (Software-as-a-Service) email security solution in 2008. Following a competitive evaluation and two-week pilot, the airline chose Proofpoint Enterprise over competing solutions because of “its highly configurable, modular approach, unrivalled anti-spam effectiveness and built-in reporting capabilities.”

EasyJet leverages Proofpoint Enterprise features including LDAP integration to automatically apply different sets of email filtering rules to different groups of users, without requiring intervention by the airline’s email administrators. Multi-lingual end-user interfaces allow EasyJet’s internationally-distributed staff to interact with the system in their native languages, based on each user’s individual preferences.

“Choosing an on-demand solution for our inbound email filtering seemed an obvious decision,” says Mark Beard, IT services manager at EasyJet. “It means one less thing for our IT team to worry about while greatly reducing our overall costs of providing email security. Proofpoint’s solution has reduced the administrative strains placed on the team while still retaining complete control over our email environment. Anti-spam and anti-virus performance has been excellent, resulting in a greatly improved experience for our email users.”

Top 2009 Email Headlines

Stephanie Jordan — Tue, 22 Dec 2009 04:31:02 +0000

Last week, Proofpoint offered a review of top email stories for 2009. Here are a few:

Steamy Sanford Affair — We’ve all heard the adage, “Don’t put in email what you wouldn’t want in the daily newspaper.” South Carolina governor, Mark Sanford, certainly did not get the memo. In June 2009, The State published steamy emails detailing Sanford’s affair with “Maria,” a woman in Buenos Aires, Argentina.

‘Climategate’ — On Nov. 17, over 1,000 emails either sent from or to members of the Climatic Research Unit (CRU) at the University of East Anglia in eastern England were allegedly hacked and leaked onto the Internet. Critics have asserted that the emails show collusion by climate scientists to withhold scientific information, while other climate scientists have called the incident a smear campaign.

Waves of Praise — Launched on Oct. 1, Google Wave is “attempting to change the way we communicate and collaborate online.” If you were one of the chosen few and received an invite, you probably gushed and praised the new tool – perhaps even claiming its instant ubiquity over email. The one major drawback however, is that one better have advanced Web skills since Wave is certainly not for dummies.

You’ve got salmonella! — A House panel investigating Peanut Corp. of America, the company accused of shipping peanut products it knew were contaminated, uncovered more surprising emails. Apparently more concerned with the company’s bottom line than human lives, President Stewart Parnell told underlings via email to continue shipping product despite knowledge of the salmonella outbreak.

Conficker Hype — Panic over the worm reached a frenzy leading up to April 1. In the end, Conficker didn’t fool us as it came and went with a whimper.

For more of Proofpoint’s most notable email stories of 2009, visit the company’s Web site.

Perceptions About Cloud Computing

Stephanie Jordan — Tue, 01 Dec 2009 04:47:24 +0000

About a year ago, I wrote Pinching Pennies with SaaS for Messaging News. At that time, I wrote:

There is a lot of talk about “cloud” computing, often being used interchangeably with the term SaaS (software-as-a-service). It is interesting to note that these terms mean different things to different people. According to IDC, cloud-based software, as well as SaaS and hosted messaging security are “essentially variations of the same thing; such software is characterized by the software, services, and support offerings that are specifically built and designed for one-to-many delivery over the Internet.”

Earlier this month results were announced from an August survey, conducted by Osterman Research and Proofpoint, Inc., which concluded that cloud computing confusion continues.

It seems that the confusion still stems from the fact that “cloud” means different things depending on definitions and perceptions assigned to the term. The contention of the survey is that this confusion may be stalling enterprise adoption of cloud computing technologies.

The uncertainty is not only among non-IT folks — although of the 200 information technology (IT) professionals that participated in the survey just 24 percent thought their CEO could define cloud computing, and 59 percent thought their CEO would fail – but also IT types too.

According to the report: “Nearly 40 percent of IT professionals answered ‘yes’ to the question, ‘when I hear the term ‘cloud computing,’ I am generally confused given the many definitions’ (52 percent answered ‘no’). Thirty-three percent believe cloud computing is more hype than substance, while 24 percent ‘weren’t sure’.”

Definitions are not the only inconsistency. Perceptions in quality also range when it comes to cloud-based offerings. “When asked about the difference in the quality of cloud-based email security services and cloud-based email archiving services, a large number of IT professionals polled believe the differences are significant,” says the report. “Forty-six percent of respondents see a significant difference between the cloud-based email security offerings on the market (19 percent do not), while 43 percent see a significant difference between the cloud-based email archiving solutions (21 percent do not).

Regarding the survey, Gary Steele, CEO of Proofpoint, comments: “The takeaway is that clearly all clouds are not created equal. Given the increasing number of SaaS email security and compliance solutions available and differences in data security, service level agreements, effectiveness and ease-of-use, enterprises must conduct their due diligence when moving these types of functions to the cloud.”

Regardless of the confusion, interest in the cloud continues to grow, aided by current economic conditions. As an example, in this month’s cover story Preserving Email Through Hosted Archiving, The Radicati Group’s research shows that while a greater percentage of archiving solutions are deployed on-premises, “the deployment of hosted archiving solutions is growing at a faster rate than the deployment of on-premises products. Hosted services are much more affordable in the short run, which helps many companies to give them a try particularly in a slow economy.”

It will be interesting to see where we are in the definitions, perceptions and adoption of cloud-based solutions a year from now.

Eye on Messaging is written by Stephanie Jordan, editor in chief of Messaging News. If you have story ideas or news to share, email her: sjordan [at] messagingnews [dot] com

Setting A Retention Policy

Stephanie Jordan — Tue, 24 Nov 2009 18:37:02 +0000

Some organizations develop messaging retention policies based on regulation requirements, but many organizations do not have such guidelines to follow. Andres Kohn, vice president of technology and product management for Proofpoint sees no standard among its customers. “We see people with really different philosophies. I’d say we have customers that may keep data for just three months in archive. Or there are others who only allow 20 days worth of email in their inbox. But there are others that say 10 years.” When asked what is the most common duration of retention, Kohn replies, “Three to five years is what most organizations do, but we definitely have organizations that have really short policies and really long policies. And there are pros and cons to both.”

One of the important things to remember is that when an organization has a retention policy, it must adhere to it. “If you say, and can prove, that you only have three months of data, and you have systems in place to enforce that, then even if asked for three years of data, it is okay to say: ‘I only have three months.’ It does keep your costs down,” says Kohn, when noting the positives of having a short retention policy.

The nature of email messages is that there is a sender and a recipient, however. Which means, that if you have a short-term retention policy, there is a good chance that the other side may not. They may have a message, which you do not, and it may be the proverbial smoking gun. “A lot of legal counsels would rather have everything and be able to go through and know what is there—especially before the case goes to trial,” explains Kohn. “In that way, an organization may be able to make a more informed decision to settle a case or to fight, based on a full scope of evidence.”

No Retention Policy

It is not uncommon to not have a retention policy. “Most organizations are unclear about the retention policies they should adopt,” comments David Ferris, president and senior analyst of Ferris Research in a blog. Ferris points out that not having a retention policy can slow the deployment of archiving, but he is not in favor of that impeding implementation. “It usually makes sense to go ahead with archiving in advance of having decided one’s retention policy. Start by archiving everything, for an indeterminate period,” he recommends. “You’ll still get many of the advantages of archiving, such as better user mailbox performance, better eDiscovery, and reduced backup times. As you go along, you can reduce the scope of archiving (e.g., don’t include spam) and define retention policies.”

While the courts have not come out with a particular retention policy length, organizations are required to turn over any relevant data that exists, should it be requested. The problem can be that an organization does not have easy access to all messages. “I see organizations that say, we are going to have a six month retention policy, but then allow users to create PST files, so in reality, they have many year’s worth of emails on people’s laptops or network drives, but they don’t have central access to it,” points out Kohn. “If the court determines that is the case, and that there is evidence to be dug up, the court can order access to everybody’s laptops to get to the information and try to piece it all together. Many organizations are becoming smarter about saying the amount of information that is kept in archive has to be at least as much, if not more, that what users are allowed to keep.”

Without real guidance from a particular regulation, developing a retention policy can be difficult within the organization, because different people have different perspectives on what is important to keep and for how long. Ferris believes that this will ease over time. “In the fullness of time, most organizations will keep almost all of their electronic content (excluding spam, for example) for an arbitrarily long period because of the cheapness of storage, the expense of deleting material, and the value of holding on to material in case it is useful. Retention policies will gradually become less of a burning issue.”

Preserving Email Through Hosted Archiving

Stephanie Jordan — Tue, 24 Nov 2009 18:20:47 +0000

When message archiving came on the scene, most thought of it as a concern for only the most regulated vertical, like financial services. In December 2006, however, when the Federal Rules of Civil Procedure (FRCP) were amended to include the discovery of electronically stored information, archiving took on a whole new importance to a much wider audience. For organizations, it meant re-thinking and changing the way electronic communications were collected, reviewed and made available in response to a discovery request. Many sought out on-premises archiving solutions to meet electronic discovery and regulation compliance, but others felt archiving, while important, ranked low on the priority list for precious IT budget dollars.

Today, according to The Radicati Group, “On-premises archiving products continue to be the most popular way to deploy an archiving solution, with 75 percent of all archiving solutions sold as on-premises products, compared to 25 percent of archiving solutions sold as hosted services.” This may not remain the case. Radicati research also shows that, “The deployment of hosted archiving solutions is growing at a faster rate than the deployment of on-premises products. Hosted services are much more affordable in the short run, which helps many companies to give them a try particularly in a slow economy.”

With the rise in acceptance of other software-as-a-service (SaaS) offerings, it makes sense that archiving in this model will also enjoy a spike in popularity. “I think for companies that are not in financial services, it may be perceived as a little riskier,” observes Stephen Marsh, CEO and founder of Smarsh. “We saw the exact same behavior in financial services several years ago. Everyone was hesitant early on, but companies ultimately started realizing that they were wasting their own time and money. Service providers, in many cases, are more secure and have better measures to protect data, because their businesses depend on it. In-house IT staffs have a million other projects completely unrelated to data protection. The reality is the service provider has the better infrastructure.”

Benefits of SaaS Archiving

Cost savings is often seen as a primary reason for going the hosted route. “Osterman Research’s recent analysis of the cost of email archiving solutions showed that SaaS email archiving can offer dramatic cost savings versus an on-premises approach,” confirms Michael Osterman, CEO of Osterman Research. “These savings can be realized even for very large organizations and regardless of required retention periods, compliance requirements or redundancy requirements.”

Most industry experts will point to cost being a prime benefit of the cloud model. But there are other benefits too. Mary Kay Roberto, senior vice president and general manager for Mimecast, says a top customer mention is that: “The streamlining of email administration is significant—since the admin no longer has to be concerned about the hardware and software maintenance, the cost reduction associated with hardware and software to support the archive, and the elimination of the costs of upgrading hardware and software and eliminating the need for storage additions. This saves significant time and enables the administrator to focus on proper policy management for the archive and operational management for the email system.” (Of course this also brings in the cost-savings benefit again too, Roberto says the cost of upgrades is particularly burdensome as is the cost and management of storage. She says it is common to see cost savings in the 30 to 60 percent range over on-premises systems.)

That cost benefit is especially attractive in our current economy. “We have seen a big, big shift over the last year and a half, as a function of what is happening in the economy,” observes Marsh. “A lot of larger organizations are less certain about what their organization might look like in the next six to twelve months. If there is any risk of downsizing, they do not want to make the capital investment to buy a large on-premises solution or to build a solution that today might accommodate 10,000 users and in six months may need to only accommodate 5,000 users.”

Another benefit often cited, says Roberto, is the continuity aspects of a cloud archive, which gives an organization significantly better access to data when there are issues in the data center without the extensive cost of having second data center location. “As a foundation of all of this, is the fact that IT will contribute to their corporate ‘green initiatives’ by reducing the number of servers required to provide email management. In our cloud solution, we typical see a reduction of 30 on-premises servers for one of Mimecast’s.” Roberto notes that the reduction statistic incorporates the organization utilizing the Mimecast Unified Email Management, which includes inbound and outbound perimeter security, email continuity, and archiving.

With these benefits, one wonders why the hosted model hasn’t been embraced sooner. “We have seen, going back to financial services in the early days, many of the medium to larger firms that have their own IT staff initially gravitate toward on-premises solutions,” says Marsh. “The perception is that it is more secure, that there is more control, and that they can produce data quicker. In fact, all of those things are counter-intuitively not true.”

According to Marsh, he has seen a lot of customers move from on-premises to the hosted platform for a variety of reasons. “A lot of times companies get fed up with the whole process of upgrading their software, their systems, add additional storage, etc. The IT departments, who initially wanted control, get fed up with having to support their legal department, their HR department, and their end-users, when it comes to email archiving. In many of these organizations, the legal department is asking for data on a weekly basis. I think the legal or compliance departments struggle with getting the data quickly, it is like pulling teeth in some occasions.” Marsh points out that Smarsh provides a service whereby a dedicated customer service department does nothing but help produce data when needed.

Customers being disillusioned with on-premises solutions are something that Andres Kohn, vice president of technology and product management for Proofpoint has seen too. The reason for that, he says is partly due to the maturation of archiving. “The first generation of archiving solutions were all on-premises—where you had to build up infrastructure to keep email,” explains Kohn. “In fact, the original archives were all about storage management. Taking email out of Microsoft Exchange and putting it somewhere else that was a lower cost, yet could still be accessed somehow. But once we got into more of the eDiscovery, it becomes a lot harder, and more expensive to manage that scale. We have customers that routinely come to us and say, ‘I run a search on my on-premises archive and it may take hours or days or weeks even to get the search results back.’”

Security

When weighing between on-premises and SaaS, security is a concern that can tip the favor toward on-premises. It is perceived that the data is more secure onsite. Not true says Kirk Averett, director of product for the Email & Apps division of Rackspace, “The cloud is more secure than on-premises systems for our email archives. Why? Real data centers have true physical and logical security, generally far more than even some of the world’s biggest and best enterprise companies. Combined with our DoD and PCI-DSS level encryption and separate storage silos for customers we have a high degree of confidence that the data is secure.”

Roberto believes that a vendor should be able to demonstrate the encryption strategy for data, describe and validate the physical security, and demonstrate the interface to the customer’s LDAP. “Often with these three elements, the data is more secure in the cloud than it is on premise,” she asserts.

For Proofpoint, the company saw the security issue as one of the biggest concerns people think of with SaaS. Kohn describes it this way: “I am now sending a copy of every email that I send and receive to somebody else. People got over that with inbound scanning, because they figured it was coming from the Internet anyway, but when you talk about all your internal email correspondence, that gets scarier. So people were really looking for a high-level of security, and that is where we have stepped into the fray.”

Proofpoint ARCHIVE is a hybrid model, where it is neither all on-premises, nor all in the cloud. “We decided to put what we thought were the right components in the right places,” explains Kohn. “Most of the infrastructure lives in our data centers. We also place a lightweight appliance that sits at the client site. What happens is that the appliance talks to the mail server; it grabs copies of all the messages, and encrypts it with a key that only the appliance has, and sends it to us encrypted. We have no way of ever being able to read any of the content, because the only key sits at the customer site. When a customer wants to do a search, they go to the appliance and the appliance encrypts the search terms and sends that to us. We get the results, but we do not even know what they are searching for.”

This concept of the third-party vendor not snooping through an organization’s email records is important. “Sometimes the security question might be a smokescreen over a different concern around who controls the customer’s data: the hosting company or the customer,” says Averett. “Rackspace, as well as every other responsible email archiving provider, has strong policies and protections in place to make sure that data remains private and in the control of the customer.”

Disaster Recovery

For some, the fact that the data is located at another site is a benefit of the SaaS approach. “We have found the disaster recovery (DR) aspect interesting,” says Kohn. “People are doing back ups, but they do view the archive as a little bit of a DR solution. If there is a gap in a back up or somebody wants something they deleted from their mailbox, they know there is a copy in the archive. So even though it is not meant to be a back up and restore, it does provide a second-layer of protection beyond a backup, and it is offsite.”

Marsh acknowledges that Smarsh customers also like the DR angle. “Organizations can use the storage at a third-party as a disaster recovery solution as well,” he agrees. “Inherently to get the data to a service provider, you have a copy securely stored somewhere else. Many of our customers will use that to rebuild email servers if they have problems, to re-populate an email server, or they use our service to restore even individual messages that in the past required the IT department to reload tapes and find a single message. It is an entirely overlooked benefit to using a service provider.”

While no one believes that a company should consider SaaS archiving to be the same as a true DR solution, it can be of help in a truly unusual circumstance. “Email archiving offsite, particularly at the low price point that we offer of $3 USD per mailbox, is the fastest and least expensive way to make email data available through a second service and location, in the unlikely event that something catastrophic happens at a primary data center,” states Averett. “Keep in mind that people using a hosted email solution almost always have live copies of all of their data, so only the most disastrous of circumstances would make the continuity features necessary.”

Reducing eDiscovery Costs

While DR may be an unexpected bonus of archiving, an expected benefit is the reduction of litigation costs. Deployment of an email archiving solution will save organizations both time and money in their early case assessment programs, contends the Smarsh paper, Reduce Litigation Costs Using Email Archiving for Early Case Assessment. “As we talked to more and more fortune 500 companies, and others that have a general counsel, a theme lately has been reducing eDiscovery costs,” reveals Marsh. “It was bound to happen sooner or later, but the economy has really accelerated that. Firms do not want to take all their email and hand it over to outside attorneys and say: ‘Here, find anything that is relevant.’ They want to do more themselves, but currently do not have the tools to do even a cursory search of their archive to find out what might be lurking out there in their emails or what an eDiscovery might find.”

By doing more in-house, organizations can reduce outside legal bills. “The cost of eDiscovery has increased over time, often because of the burden of location and restoring information, if it is not in an archive,” warns Roberto. “Archives with robust search capabilities will facilitate the eDiscovery process and help reduce the overall cost. Part of the cost is the salaries or consulting fees required to gather data, if it is not in an archive. As an example, even for a mid-sized organization who might take eight to 10 hours to retrieve data from DVD or tape for individual cases could reduce that time to an hour or less with the appropriate archive. From a risk management standpoint, being able to verify a search and show validity of data can save significant legal costs as the case proceeds. Finally, avoiding sanctions because data cannot be produced in a timely and accurate fashion is essential for a corporation’s legal department. All of this supports having an archive in place, particularly if the organization can set appropriate retention policies to different segments of the email data, thus being able to demonstrate compliance with corporate policy.”

Sometimes the reduction on eDiscovery costs, however, is hard to calculate. “There are two major components of that,” offers Kohn, “One is cost of finding the data, getting back up tapes, getting users laptops, etc. The other and biggest cost of eDiscovery comes when a company passes a ton of email to a law firm to process it. They are going to charge based on how much data is given to them. If instead, you have a solution that allows you a very flexible and powerful search capability and you are able to hold down the amount of data provided to the law firm, then they can charge only for what is given them, so there is huge savings there.”

Keeping Up With Regulations

Another area where SaaS archiving can offer unique benefits is business regulations. Understanding, and complying with an evolving list of rules is challenging, if an organization is not aware of what regulations they’re responsible for. “A service provider deals with conflicting regulations all the time,” says Marsh. “I would certainly not say that we are a consulting firm that sells advice, but we have other clients that have been through similar scenarios. We do have practical opinions and perspectives that we can provide just from our many customer relationships. That also translates into SaaS customers getting the latest technology all the time, not just from a whiz-bang perspective—because there is value in your getting the latest and greatest technology—I think it is also relevant that as regulations evolve, companies that use a service provider don’t have to change anything to be compliant or implement industry best practices. Once we hear from one customer that a court says they have to do X, we start to develop trends and can make changes to our product adding new features and functionality that benefit all our customers. For those with on-premises, they are going to have to upgrade in order to add features and functionality.”

Moving to the Cloud

If The Radicati Group is correct in its prediction that deployment of hosted archiving solutions are growing faster than on-premises, it signals that organizations are becoming more comfortable with the platform. “Many customers were initially hesitant to make the move to the cloud because their data is so important to their business operations,” states Roberto. “Once they understand the level of security, the range of functionality, and the simplicity of email management, they became comfortable with the concept. They were also reassured when they understand that they would still administer their system and set their own policies, and that they were totally in control of their data.”

Perhaps it is archiving as a whole that has become more accepted. “The trend away from archiving as a specialty need is growing more and more,” says Averett. “A year ago you could find companies beginning to think about archiving as a productivity tool, and now that seems to be the most common case. It will always be valuable for regulatory compliance, and we won’t be surprised if more industries are required to archive in the future.”

Being in the cloud does offer the ability to more easily manage what promises to be ever-growing piles of data. “For us, the power of having a SaaS solution is that we are able to spread the data out for any given customer across many, many servers. When they come to a search, on average 30 servers will light up and perform that search. So the results are able to come back really quickly, because each server is doing only a little bit of work. There is no way anyone is going to buy 30 servers to deploy an on-premises solution, but we can do that because we can share that compute power across many different customers, and that is the power of the cloud.”

With the viable options for either on-premises or SaaS, there is no reason not to archive anymore. SaaS pricing makes the cost of archiving predictable for any size organization, and archiving protects companies in the event of an electronic discovery request, and helps to comply with various rules and regulations. “In the 15 months since we acquired Fortiva, there has been a change from people saying: ‘I would love to do archiving, but it is further down on my priority list’ to people that are talking about and actively implementing archiving,” observes Kohn. “We have seen a greater shift towards SaaS, interestingly, not only from people who are for the first time saying: ‘I should do something and there is a lower cost way to do it now’, but also getting a lot of traction in organizations that already have an in-house archiving solution that are realizing after several years that with the amount of data they have, it is not usable and is hard to manage. Even they are saying: ‘I can move this to a SaaS solution, with less hardware and people, and I can save money.’”

As the benefits of having an archiving solution are better understood, attitudes toward archiving will change. The reason that has not yet happened may be that organizations are only starting to see beyond the practice as a necessary evil or as regulations that must be complied with, suggests Marsh: “There are a lot of benefits. Rarely do companies consider the IT benefit of off-loading the mail from their primary server so that they can keep that server lean and operating optimally. They may not consider the DR functionality, of being able to produce a single message for an end-user in ten seconds versus restoring back up tapes for hours down in the data center. They probably do not think about the value of retaining all of their institutional knowledge that is exchanged in email day in and day out, or consider that as employees leave, there is potential for all that data to go out the door with them.”